georchestra / georchestra-gateway

GNU General Public License v3.0
0 stars 5 forks source link

custom headers configuration on targets is ignored ? #120

Open pmauduit opened 4 months ago

pmauduit commented 4 months ago

TIL it was necessary to define globally the headers you want to have, no matter if the configuration is customized for each targets.

For example, considering the following datafeeder configuration:

      datafeeder:
        target: ${georchestra.gateway.services.datafeeder.target}
        headers:
          json-user: true
          json-organization: true

One could expect the sec-user / sec-organization json versions of the header to be provided to the datafeeder, but one will also need the following global configuration to actually have them as expected:

georchestra:
  gateway:
    default-headers:
      # Default security headers to append to proxied requests
      proxy: true
      username: true
      roles: true
      org: true
      orgname: true
      json-user: true
      json-organization: true

At least, we should provide a default datadir configuration which should work with the basic geOrchestra webapps. (e.g. https://github.com/georchestra/datadir/blob/master/gateway/gateway.yaml#L7-L17 to be fixed).

pmauduit commented 3 months ago

I wonder what the intended behaviour was, trying a JDWP session with the docker composition provided at the root of the repository, I have the feeling that the headers part in the JSON above is ignored, and somehow the default part is always injected by Spring at bootstrap into each GeorchestraTargetConfig objects being instanciated: https://github.com/georchestra/georchestra-gateway/blob/main/gateway/src/main/java/org/georchestra/gateway/model/GeorchestraTargetConfig.java#L35-L53